How to Master One of the Hardest Parts of the ISC2 CGRC Exam: Selection and Approval of Controls

Domain 3 of the Certified in Governance, Risk and Compliance (CGRC)® exam, Selection and Approval of Framework, Security, and Privacy Controls, is where many candidates lose points they expected to earn. The terms sound familiar, but the questions ask you to make decisions: which baseline applies, whether a control can be inherited, when tailoring is justified, and who approves the result.

Several things make this domain tricky. Control catalogs are huge, and it’s easy to get lost in individual controls instead of the selection process. Tailoring, inheritance, and compensating controls overlap in confusing ways. The domain also depends on the categorization you did in Domain 2.

This guide breaks down what the domain covers, the concepts that matter most, the traps to avoid, and how to reason through the scenarios ISC2 likes to test.

What Does Selection and Approval of Controls Cover on the CGRC Exam?

In the ISC2 CGRC Certification Exam Outline (effective June 15, 2024), Domain 3 accounts for 14% of the exam, or roughly 17 or 18 of the 125 items. It has two task statements:

  1. Identify and document baseline and inherited controls.
  2. Select and tailor controls, which includes determining applicable baseline and inherited controls, choosing control enhancements, identifying data handling and marking requirements, documenting control selection, developing a continued compliance strategy, and allocating controls with stakeholder agreement.

These tasks line up closely with the Select step of the NIST Risk Management Framework in SP 800-37 Rev. 2. That step includes control selection, control tailoring, control allocation, documentation of planned control implementations, a system-level continuous monitoring strategy, and plan review and approval.

What Core Concepts Do You Need to Know?

Categorization Drives Selection

Control selection starts with the system’s security category from Domain 2. Under FIPS 199, each information type is rated low, moderate, or high for confidentiality, integrity, and availability. FIPS 200 then applies the high-water mark: the system’s overall impact level is the highest rating across all three objectives. A system rated moderate for confidentiality, low for integrity, and high for availability is a high-impact system, so it starts from the high baseline.

Control Baselines

NIST SP 800-53 Rev. 5 is the control catalog, organized into 20 families such as Access Control (AC), Audit and Accountability (AU), and Supply Chain Risk Management (SR). SP 800-53B provides the baselines:

  • Low, moderate, and high security baselines, matched to the system’s impact level.
  • A privacy baseline, which applies whenever a system processes personally identifiable information (PII), regardless of its security impact level.

Other frameworks work similarly. FedRAMP baselines are built on SP 800-53. ISO/IEC 27001 organizations choose Annex A controls and justify inclusions and exclusions in a Statement of Applicability. CMMC Level 2 maps to the 110 requirements in NIST SP 800-171.

Common, System-Specific, and Hybrid Controls

  • Common controls come from one source and are inherited by multiple systems. Examples include a data center’s physical security or an enterprise security awareness program. The common control provider implements, assesses, and monitors them.
  • System-specific controls are the system owner’s responsibility.
  • Hybrid controls are partly inherited and partly system-specific. For example, the organization provides an incident response policy, but the system team writes system-level procedures.

Inherited controls still appear in the system security plan (SSP). You document what you inherit and from whom. The inheriting system also accepts the risk if the common control is weak.

Tailoring

A baseline is a starting point, not a final answer. SP 800-53B describes tailoring activities that include:

  • Identifying and designating common controls.
  • Applying scoping considerations, such as removing wireless controls from a system with no wireless capability.
  • Selecting compensating controls.
  • Assigning values to organization-defined parameters, like how often to review accounts.
  • Supplementing the baseline with additional controls or control enhancements when risk requires it.
  • Providing specification information for implementation.

Every tailoring decision must be justified and documented. Tailoring down without a documented rationale is one of the most common exam distractors.

Compensating Controls

A compensating control is an alternative that provides equivalent or comparable protection when a baseline control can’t be implemented. The rationale, and any residual risk, must be documented in the SSP and accepted by the appropriate official. PCI DSS uses a similar idea through its compensating control worksheets.

Continuous Monitoring Strategy and Approval

During selection, you also plan how controls will be monitored over time, including what gets checked and how often. This system-level strategy connects directly to Domain 7. Finally, the security and privacy plans are reviewed and approved by the authorizing official (AO) or a designated representative. The AO’s approval confirms the plans are complete and consistent before implementation begins.

What Are the Most Common Domain 3 Traps?

  • Selecting controls before categorization. If an answer jumps to choosing controls for a system that hasn’t been categorized, it’s out of order.
  • Averaging impact levels. Moderate, low, and high don’t average to moderate. The high-water mark makes the system high.
  • Forgetting the privacy baseline. A low-impact system that processes PII still needs privacy controls.
  • Assuming inherited controls need no documentation. They must be identified in the SSP, and the system owner relies on the provider’s assessment results.
  • Confusing scoping with compensating. Scoping removes a control that doesn’t apply. A compensating control replaces one that applies but can’t be implemented as written.
  • Giving approval to the wrong person. The system owner develops the plans. The AO approves them. The assessor evaluates controls but doesn’t approve plans.

How Do You Reason Through a Domain 3 Question?

Sample Scenario 1: The Hosted Application

Consider a question about a moderate-impact application hosted in a FedRAMP-authorized cloud environment. The system owner wants to mark all physical and environmental protection controls as “not applicable” because the team never touches the hardware. What should the ISSO recommend?

Choices might include removing the controls through scoping, implementing them locally, accepting the risk, or documenting them as inherited from the cloud provider.

The best answer is to document them as inherited and reference the provider’s authorization package. The controls apply to the system because the hardware still needs protection. Responsibility simply rests with a common control provider. Marking them “not applicable” would misrepresent the system’s actual risk.

Sample Scenario 2: The Legacy Limitation

Now imagine a legacy system that can’t support multifactor authentication for a subset of administrative accounts, a control required by its baseline. The vendor has no upgrade planned for a year. What’s the best course of action?

The best answer is to select a compensating control, such as restricting those accounts to a hardened jump host with session recording, then document the rationale and residual risk in the SSP for AO review. You can’t delete the control because it’s inconvenient, and you shouldn’t treat it as fully implemented. Many questions also expect a POA&M entry to track the planned fix.

How Does Domain 3 Connect to Other Domains?

  • Domain 1: Laws, frameworks, and organizational risk tolerance determine which catalogs and baselines apply.
  • Domain 2: Information types and the impact level decide your starting baseline.
  • Domain 4: The controls, parameters, and allocations you select become the implementation plan.
  • Domain 5: Assessors test exactly what the SSP says was selected and how it was implemented.
  • Domains 6 and 7: Tailoring decisions and compensating controls shape residual risk at authorization, and the continuous monitoring strategy drives ongoing compliance.

How Should You Study Selection and Approval of Controls?

  1. Walk through a mini system. Pick a simple system, such as an employee scheduling app that stores names and phone numbers. Categorize it, choose the baseline, decide what’s inherited, and write two tailoring decisions with rationale.
  2. Read the source. Review the Select step in SP 800-37 Rev. 2 and the tailoring section of SP 800-53B. Both are free from NIST.
  3. Memorize the roles. Make a one-page chart showing who develops, provides, assesses, and approves at each step.
  4. Practice by domain, then mix. In Pocket Prep, use Build Your Own Quiz to focus on Domain 3 until you can explain every answer. Then use Missed Questions to revisit errors, and check your Weakest Subject results to confirm the domain is improving.
  5. Return to mixed sets. Selection concepts show up in implementation, assessment, and maintenance questions, so mixed practice shows whether you can spot them when the domain isn’t named.

Start Preparing for the ISC2 CGRC Exam With Pocket Prep

Pocket Prep’s ISC2 CGRC practice questions give you 500 exam-style questions, including scenario-based items on baselines, inheritance, and tailoring, each with a detailed explanation of why the best answer wins. Pair Build Your Own Quiz with Question of the Day to keep Domain 3 fresh. Take it one control at a time, and you’ll be ready on exam day.